Projekte pro Jahr
Abstract
Static and dynamic program analysis are the key concepts researchers apply to uncover security-critical implementation weaknesses in Android applications. As it is often not obvious in which context problematic statements occur, it is challenging to assess their practical impact. While some flaws may turn out to be bad practice but not undermine the overall security level, others could have a serious impact. Distinguishing them requires knowledge of the designated app purpose.
In this paper, we introduce a machine learning-based system that is capable of generating natural language text describing the purpose and core functionality of Android apps based on their actual code. We design a dense neural network that captures the semantic relationships of resource identifiers, string constants, and API calls contained in apps to derive a high-level picture of implemented program behavior. For arbitrary applications, our system can predict precise, human-readable keywords and short phrases that indicate the main use-cases apps are designed for.
We evaluate our solution on 67,040 real-world apps and find that with a precision between 69% and 84% we can identify keywords that also occur in the developer-provided description in Google Play. To avoid incomprehensible black box predictions, we apply a model explaining algorithm and demonstrate that our technique can substantially augment inspections of Android apps by contributing contextual information.
In this paper, we introduce a machine learning-based system that is capable of generating natural language text describing the purpose and core functionality of Android apps based on their actual code. We design a dense neural network that captures the semantic relationships of resource identifiers, string constants, and API calls contained in apps to derive a high-level picture of implemented program behavior. For arbitrary applications, our system can predict precise, human-readable keywords and short phrases that indicate the main use-cases apps are designed for.
We evaluate our solution on 67,040 real-world apps and find that with a precision between 69% and 84% we can identify keywords that also occur in the developer-provided description in Google Play. To avoid incomprehensible black box predictions, we apply a model explaining algorithm and demonstrate that our technique can substantially augment inspections of Android apps by contributing contextual information.
| Originalsprache | englisch |
|---|---|
| Titel | ICT Systems Security and Privacy Protection - 35th IFIP TC 11 International Conference, SEC 2020, Proceedings |
| Redakteure/-innen | Marko Hölbl, Tatjana Welzer, Kai Rannenberg |
| Erscheinungsort | Cham |
| Herausgeber (Verlag) | Springer International Publishing AG |
| Seiten | 171-186 |
| Seitenumfang | 16 |
| Band | 580 |
| ISBN (elektronisch) | 978-3-030-58201-2 |
| ISBN (Print) | 978-3-030-58200-5 |
| DOIs | |
| Publikationsstatus | Veröffentlicht - Sept. 2020 |
| Veranstaltung | 35th International Conference on ICT Systems Security and Privacy Protection - Maribor, Slowenien Dauer: 21 Sept. 2020 → 23 Sept. 2020 https://sec2020.um.si |
Publikationsreihe
| Name | IFIP Advances in Information and Communication Technology |
|---|---|
| Band | 580 IFIP |
| ISSN (Print) | 1868-4238 |
| ISSN (elektronisch) | 1868-422X |
Konferenz
| Konferenz | 35th International Conference on ICT Systems Security and Privacy Protection |
|---|---|
| Kurztitel | IFIP SEC 2020 |
| Land/Gebiet | Slowenien |
| Ort | Maribor |
| Zeitraum | 21/09/20 → 23/09/20 |
| Internetadresse |
ASJC Scopus subject areas
- Informationssysteme und -management
- Information systems
- Computernetzwerke und -kommunikation
Fingerprint
Untersuchen Sie die Forschungsthemen von „Code between the Lines: Semantic Analysis of Android Applications“. Zusammen bilden sie einen einzigartigen Fingerprint.Projekte
- 1 Laufend
-
A-SIT - Zentrum für sichere Informationstechnologie Austria
Stranacher, K. (Teilnehmer (Co-Investigator)), Dominikus, S. (Teilnehmer (Co-Investigator)), Leitold, H. (Teilnehmer (Co-Investigator)), Marsalek, A. (Teilnehmer (Co-Investigator)), Teufl, P. (Teilnehmer (Co-Investigator)), Bauer, W. (Teilnehmer (Co-Investigator)), Aigner, M. J. (Teilnehmer (Co-Investigator)), Rössler, T. (Teilnehmer (Co-Investigator)), Neuherz, E. (Teilnehmer (Co-Investigator)), Dietrich, K. (Teilnehmer (Co-Investigator)), Zefferer, T. (Teilnehmer (Co-Investigator)), Mangard, S. (Teilnehmer (Co-Investigator)), Payer, U. (Teilnehmer (Co-Investigator)), Orthacker, C. (Teilnehmer (Co-Investigator)), Lipp, P. (Teilnehmer (Co-Investigator)), Reiter, A. (Teilnehmer (Co-Investigator)), Knall, T. (Teilnehmer (Co-Investigator)), Bratko, H. (Teilnehmer (Co-Investigator)), Bonato, M. (Teilnehmer (Co-Investigator)), Suzic, B. (Teilnehmer (Co-Investigator)), Zwattendorfer, B. (Teilnehmer (Co-Investigator)), Kreuzhuber, S. (Teilnehmer (Co-Investigator)), Oswald, M. E. (Teilnehmer (Co-Investigator)), Tauber, A. (Teilnehmer (Co-Investigator)), Posch, R. (Projektleiter (Principal Investigator)), Bratko, D. (Teilnehmer (Co-Investigator)), Feichtner, J. (Teilnehmer (Co-Investigator)), Ivkovic, M. (Teilnehmer (Co-Investigator)), Reimair, F. (Teilnehmer (Co-Investigator)), Wolkerstorfer, J. (Teilnehmer (Co-Investigator)) & Scheibelhofer, K. (Teilnehmer (Co-Investigator))
21/05/99 → 31/12/24
Projekt: Arbeitsgebiet